Automatic License Plate Readers (ALPRs) from a variety of vendors—most infamously Flock, but also products like ELSAG from a company called Leonardo—have been receiving plenty of attention as of late, for good reason. These systems can track individuals through a network of cameras, no warrants required, as my colleague here at The Drive unfortunately discovered first-hand last month. Leonardo has more recently marketed a new product called SignalTrace that isn’t an ALPR but can be paired with them to correlate plates with various wireless signals, including Wi-Fi and Bluetooth as well as frequencies emitted by everything from tire pressure monitoring sensors to pet microchips.
Or, at least, that’s what Leonardo claims, anyway; a security researcher recently dove into SignalTrace’s marketed capabilities to separate what’s feasible from what isn’t, and his analysis is worth sharing.
Ryan O’Horo is an offsec engineer and security consultant. He identified several SignalTrace installations in Oxon Hill, Maryland, courtesy of the Prince George’s County Police Department. As far as O’Horo knows, these are the only real-world deployments of SignalTrace to date, though he’s encouraging anyone who comes across any others to bring them to his attention.
So, there’s reason to believe that SignalTrace tech isn’t sprouting from lamp posts and traffic signals at every intersection in America quite yet. But what’s particularly valuable about O’Horo’s coverage—and something that, frankly, gets lost when us security laypeople talk about what these systems can actually achieve—is that it takes stock of the limitations that companies like Leonardo naturally aren’t talking about.
First off, electronics don’t incessantly broadcast identifiable data, so SignalTrace would need to catch your phone, for example, at the proper time to scoop anything up. Also, transmissions happen across channels, and it’s a challenge for one radio to keep tabs on all of them simultaneously. Leonardo could circumvent some limitations with custom components, but that’s not what the company says it’s using for SignalTrace, having advertised “off-the-shelf” parts, as O’Horo points out.
Those are a few hurdles right off the bat. As O’Horo pokes into the kinds of devices Leonardo says SignalTrace can tap into, however, we see more gaps between the product’s advertised capabilities and what’s realistically possible. Flat-panel antennas like SignalTrace’s cannot pick up the sorts of frequencies that the most common tire pressure sensors operate on. And pet microchips—RFID tags operating on very low frequencies—are usually only readable at a distance of centimeters. O’Horo speculates that what Leonardo’s marketing actually means to refer to in the latter case are Wi-Fi/Bluetooth-enabled pet collars.
That’s really the rub, here, though. Wi-Fi and Bluetooth are everywhere and obviously work at long ranges, making them especially vulnerable to tracking, and presenting the best opportunity for SignalTrace to do damage even if other potential avenues are less feasible. Although there still appears to be some distance between Leonardo’s marketing and reality—O’Horo speculates that it would take multiple passes of the same sensors, or multiple collection points to pick up all possible signals, for example—Wi-Fi and Bluetooth scanning are tools that some Flock cameras already have in their repertoire today.
In some respects, surveillance solutions like SignalTrace are being oversold but, in others, it doesn’t matter, and we’ve already arrived at the problem with what’s commercially available right now. All that said, I encourage anyone especially curious and with a penchant for the technical side of this topic to dig into O’Horo’s blog, which obviously goes into much further detail than this post.
Got a tip? Reach out to [email protected]
Read the full article here